CVE-2026-71562 Erlang CVE debrief

Who should care

Defenders responsible for systems using Erlang/OTP, specifically those using inets versions 5.10 to 9.7, should assess exposure and prioritize verification and upgrades. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and implement necessary mitigations.

Why it matters

CVE-2026-71562 is a medium-severity vulnerability in Erlang/OTP inets httpc that can lead to availability degradation through prolonged processing of large numeric headers. Defenders should prioritize verification and upgrades, especially for inets versions 5.10 to 9.7, and implement input validation and bounds checking.

• Degradation of availability due to prolonged processing of large numeric headers.
• Potential for denial-of-service (DoS) attacks through exploitation of this vulnerability.
• Need for verification of affected versions and upgrades to fixed versions.
• Importance of input validation and bounds checking for numeric headers in HTTP responses.

Technical summary

The Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.

Defensive priority

Defenders should prioritize verifying and upgrading to fixed versions of Erlang/OTP, specifically for inets versions 5.10 to 9.7, and assess exposure in their systems.

Recommended defensive actions

• Verify and upgrade to fixed versions of Erlang/OTP, specifically for inets versions 5.10 to 9.7.
• Assess exposure in systems using affected versions of Erlang/OTP.
• Implement input validation and bounds checking for numeric headers in HTTP responses.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, affected versions, and references to source-specific vulnerability assessments. The vulnerability is documented in Erlang/OTP inets httpc, affecting multiple versions. Evidence is limited to public CVE and NVD records. Defenders should verify affected versions and review vendor guidance for upgrades and mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.